Work in progress
Produced by Landis&Gyr Communications for Nortel. Landis&Gyr Communications was sold to IPM Group - who have gone bankrupt and renamed themselves to New IPMtel.
Pictures:
Serial communication protocol (600/8n1):
COIN VALIDATOR SLEEP MODE's' COIN VALIDATOR WAKE UP'g' CALC COIN VALIDATOR CHECKSUM'k' ACCEPT NEXT COIN'x' ACCEPT ALL VALID COINS'a' REJECT ALL COINS'z' COLLECT ESCROW'c' REFUND ESCROW'f' ESCROW NULL'n' LEARN ESCROW'l' <- Very important, they wont work together otherwise. REQUEST COIN STATUS'r' DISABLE SPECIFIED COIN'd' ENABLE SPECIFIED COIN'e' READ COIN VAL ADDR'q'
ROM can be dumped with q 0x0000 to 0xFFFF.
IC-markings:
[M] SC408664CB QQ1SSC-01 2C14H LLHA9408 QMV 492 AD1 P190 C 9430
the MCU is a custom-marked MC68HC05B6
EEPROM
The EEPROM is located at 0x0100-0x1FF.
Below is a side-to-side comparison of the EEPROM of a Bell Canada and a Nevada Bell coin validator. Note, that the Bell Canada validator “knows” more coins than the Nevada Bell one.
Decoding
- MS: Most significant Byte
- LS: Least significant Byte
| Offset (h) | 00 | 01 | 02 | 03 | 04 | 05 | 06 | 07 | 08 | 09 | 0A | 0B | 0C | 0D | 0E | 0F |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 00 | Options register | Checksum MS | Checksum LS | Western Electric refit flag | Nominal avg sensor C time MS | Nominal avg sensor C time LS | Nominal avg sensor F time MS | Nominal avg sensor F time LS | Nominal avg sensor G time MS | Nominal avg sensor F time LS | Instantaneous half-window for detector C | Instantaneous half-window for detector F | Instantaneous half-window for detector G | Scale factor for sensor timeout calculation MS | Scale factor for sensor timeout calculation LS | Half-window for detector C avg MS |
| 10 | Half-window for detector C avg LS | Half-window for detector F avg MS | Half-window for detector F avg LS | Half-window for detector G avg MS | Half-window for detector G avg LS | Firing duration for solenoid MS | Firing duration for solenoid LS | Minimum coin separation time | Pause time during cash or refund cycle | number of bytes in coin table | number of coins in coin table | On-time for validator entry and exit sensors (A,  | Blocked-time for escrow sensors (C, F, G) | Timeout on escrow motion (rotation jam) | Unused | Unused |
| 20 | Coin 1 | Coin 2 | ||||||||||||||
| 30 | ← 2 cont | Coin 3 | Coin 4 | |||||||||||||
| 40 | ← 4 cont | Coin 5 | ||||||||||||||
| 50 | ← 5 cont | Coin 6 | Coin 7 | |||||||||||||
| 60 | ← 7 cont | Coin 8 | ||||||||||||||
| 70 | Coin 9 | Coin 10 | ||||||||||||||
| 80 | ← 10 cont | Coin 11 | Coin 12 | |||||||||||||
| 90 | ← 12 cont | Coin 13 | ||||||||||||||
| A0 | ← 13 cont | Coin 14 | Coin 15 | |||||||||||||
| B0 | ← 15 cont | Coin 16 | ||||||||||||||
| C0 | Coin 17 (Calibration Coin A) | Coin 18 (Calibration Coin |
||||||||||||||
| D0 | ← 18 cont | Unknown (Calibration?) | 0x00 | 0x00 | ||||||||||||
| E0 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 |
| F0 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | 0x00 | ROM Version | EEPROM Config ID | ||
Options Register
- EEPROM OPTR
- 03: Part 2 of the EEPROM array is not protected; all 256 bytes of EEPROM can be accessed for any read, erase or programming operations. / Security Bit is not set
Checksum
- Some CRC - don't bother and just issue the k-command to have it calculated and written to the EEPROM automagically.
Western Electric refit flag
- Unused
Nominal avg sensor C/F/G time
- 0.25 µs increments
Instantaneous half-window for detector C/F/G
- 2 µs increments
Half-window for detector C/F/G avg
- 0.25 µs increments
Firing duration for solenoid
- 2 µs increments
Minimum coin separation time
- 8 µs increments
Pause time during cash or refund cycle
- 8 µs increments
number of bytes/coins in coin table
- not actively used
On-time for validator entry and exit sensors (A, B)
- 2 µs increments
Blocked-time for escrow sensors (C,F,G)
- 8 ms increments
Timeout on escrow motion (rotation jam)
- 64 ms increments
Coin definitions
28.05.2016: This is the first time, that coin-definitions have been publicly documented, after Krater and Kontakt started reverse-engineering the Coin validator firmware.
Each defined coin is represented by 5 measurement-values of 2 Bytes each, so 10 Bytes in total.
Each measurement of 2 Bytes/16 Bits contains the following information:
- Enable/Disable coin (E): 1 Bit
- Median value (V): 9 Bits
- Validity range (R): 6 Bits
In other words, the acceptance range for each of the five parameters, given a measured value of M is: V-R ⇐ M ⇐ V+R (If the measured value is 100 and the range is set to 30, coins with a measurement of M in between 70 and 130 will pass).
| First Byte | Second Byte | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| E | V | V | V | V | V | V | V | V | V | R | R | R | R | R | R |
The Enable-Bit is only set on the first tuple of each coin - the other four tuples have it set to zero.
Unused coin-slots are written as 0x80 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Median tuple transformation
Alway rounded to ,0.
- 1st tupel: (X1 - 0x1000) / 0x10
- 2nd tuple: X2 / 0x04
- 3rd tuple: (X3 - 0x1000) / 0x10
- 4th tuple: X4 /0x02
- 5th tuple: X5 / 0x80
Tuple construction
- Obtain a sufficient amount of test-data for each coin using the TST-command.
- Calculate median value
- Transform tuples according to section above
- Calculate necessary range (max. +- 63) to cover all measurements
- Convert median and range into single Bits and fill in table
- Convert Bit-Table into 2 Hex-numbers and write to EEPROM.
ROM Version / EEPROM Config ID
* PROCEDURE: get_coin_validator_version_num * * DESCRIPTION: This procedure gets a 4 byte version number from the coin validator. * It has the following format and EEPROM addresses: * Field EEPROM address * ----- -------------- * 1. ROM Version Number 1FC - 1FD * 2. EEPROM Config ID 1FE - 1FF
- As the EEPROM starts at 0x0100, the same value has to be substracted from above mentioned addresses.
Communication
The validator communicates with a serial protocol at 600 Baud, 8n1
Pinout
| 1 GND | 3 DIn | 5 GND | 7 GND | 9 +12VDC |
| 2 DOut | 4 GND | 6 GND | 8 GND | 10 Reset |
- DIn is data fed into the validator
- DOut is data coming from the validator
- Reset must be tied to 5VDC. To perform reset, short to GND
Commands to validator
| ASCII | Hex | FW-level name | Explanation |
|---|---|---|---|
| s | 0x73 | COIN_VALIDATOR_SLEEP_MODE | Send device to sleep; must use COIN_VALIDATOR_WAKE_UP to put back into service |
| g | 0x67 | COIN_VALIDATOR_WAKE_UP | Wake up device. Also needed after reset |
| k | 0x6B | CALC_COIN_VALIDATOR_CHECKSUM | |
| x | 0x78 | ACCEPT_NEXT_COIN | |
| a | 0x61 | ACCEPT_ALL_VALID_COINS | |
| z | 0x7a | REJECT_ALL_COINS | |
| c | 0x63 | COLLECT_ESCROW | |
| f | 0x66 | REFUND_ESCROW | |
| n | 0x6e | ESCROW_NULL | |
| l | 0x6c | LEARN_ESCROW | |
| r | 0x72 | REQUEST_COIN_STATUS | |
| d<n> | 0x64 | DISABLE_SPECIFIED_COIN | <n> is index of coin to be disabled; eg. d1 |
| e<n> | 0x65 | ENABLE_SPECIFIED_COIN | <n> is index of coin to be enabled for acceptance; eg. e3 |
| q<n><m> | 0x71 | READ_COIN_VAL_ADDR | <n> <m> is the address of the byte to be dumped from the device. EEPROM is from 0x0100 to 0x01FF. To dump first digit of ROM Version: 0x71 0x01 0xFC |
| TST | 0x54 0x53 0x54 | n/a |  Enable Test-Mode: Measurement data for each following deposited coin is returned. |
| EAPw <n><m> | 0x45 0x41 0x50 0x77 | n/a |  Write <m> to EEPROM-address <n> (0x00 < = n < = 0xFF). Wait 20ms between issuing EAPw, <n> and <m> |
17.03.2016: This is the first time, that the commands TST and EAPw have been publicly documented, after Kontakt started reverse-engineering the Coin validator firmware.
Replies from validator
| ASCII | Hex | FW-level name | Explanation |
|---|---|---|---|
| 0 | 0x30 | INVALID_COIN | Coin could not be validated (or was not enabled) |
| 1 | 0x31 | COIN_1 | |
| 2 | 0x32 | COIN_2 | |
| 3 | 0x33 | COIN_3 | |
| 4 | 0x34 | COIN_4 | |
| 5 | 0x35 | COIN_5 | |
| 6 | 0x36 | COIN_6 | |
| 7 | 0x37 | COIN_7 | |
| 8 | 0x38 | COIN_8 | |
| 9 | 0x39 | COIN_9 | |
| a | 0x61 | COIN_10 | |
| b | 0x62 | COIN_11 | |
| c | 0x63 | COIN_12 | |
| g | 0x64 | COIN_13 | |
| e | 0x65 | COIN_14 | |
| f | 0x66 | COIN_15 | |
| g | 0x67 | COIN_16 | |
| h | 0x68 | CALIBRATION_COIN_A | Calibration Coin 1 - not used anymore in the field |
| i | 0x69 | CALIBRATION_COIN_B | Calibration Coin 2 - not used anymore in the field |
| A | 0x41 | COIN_VALIDATOR_ALLS_WELL | |
| B | 0x42 | COIN_VALIDATOR_STATUS | |
| C | 0x43 | COIN_VALIDATOR_HW_FAULT | |
| D | 0x44 | COIN_ESCROW_FAULT | |
| E | 0x45 | COIN_EEPROM_CHECKSUM_FAILURE | Can mostly be fixed by requesting new Checksum-calc with “k” |
| F | 0x46 | COIN_PWR_UP_RAM_FAULT | |
| G | 0x47 | COIN_ERROR_UNKNOWN_CMD | |
| H | 0x48 | COIN_EEPROM_WR_FAILURE | |
| I | 0x49 | COIN_VALIDATOR_JAM | |
| J | 0x4A | COIN_ENTRY_FRAUD_ATTEMPT | |
| N <x> | 0x4E | COIN_TST_DATA | Returns coin-measurement-data in the following format: “N<AAAA> <BBBB> <CCCC> <DDDD> <EEEE>\r\n”. Data in <> is hexadecimal. |
17.03.2016: This is the first time, that N-command has been publicly documented, after Kontakt started reverse-engineering the Coin validator firmware.